Fall 2019 – University of Virginia 1© Praphamontripong

Graph: Data Flow Coverage for

Source Code

CS 3250Software Testing

[Ammann and Offutt, “Introduction to Software Testing,” Ch. 7.3]

Fall 2019 – University of Virginia 2© Praphamontripong

Structures for Criteria-Based Testing

Four structures for modeling software

Input space

Graph

Source

Design

Specs

Use cases

App

lied

to

Logic

Source

Specs

FSMs

DNF

App

lied

to

Syntax

Source

Models

Integration

Inputs

App

lied

to

R--R RI-R RIPR---R

Fall 2019 – University of Virginia 3© Praphamontripong

Graph for Source Code� Graph coverage criteria are widely used on source code

� Define graph, then apply coverage criterion

� Control flow graph (CFG): the most common graph for source code

� Node coverage: execute every statement

� Edge coverage: execute every branch

� Data flow coverage: augment the CFG with� defs: statements that assign values to variables� uses: statements that use variables

Review

Fall 2019 – University of Virginia 4© Praphamontripong

Control Flow Graph (CFG)� Represent the control flow of a piece of source code

� Nodes represent basic blocks � Basic blocks represent sequences of instructions /

statements that always execute together in sequence

� Edges represent control flow (branch) between basic blocks� Transfer of control

� Initial nodes correspond to a method’s entry points

� Final nodes correspond to a method’s exit points� Return or throw in Java

� Decision nodes represent choices in control flow� if or switch-case blocks or condition for loops in Java

� Can be annotated with extra information such as branch predicates, defs, and uses

Review

Fall 2019 – University of Virginia 5© Praphamontripong

Exercise� Basic blocks (nodes)

1: if (v == null)2: throw .. NPE;3: n=0; i=0;4: i < v.length;5: if (v[i] == c)6: n++;7: i++;8: return n;

� Control flow (edges)1à2, 1à33à44à5, 4à85à6, 5à76à77à4

� Entry node1

� Exit nodes2, 8

Revisit

Fall 2019 – University of Virginia 6© Praphamontripong

CFG for numberOccurrences()

1v == null

n=0i=02 3

return n

v != null

throw … NPE

4

8

i >= v.length

5

i < v.length

7i++

n++6

v[i] == c

v[i] != c

Fall 2019 – University of Virginia 7© Praphamontripong

1

2 3

4

8 5

7

6

Applying Data Flow Coverage

use(1,2)={v}

def(3) = {n, i}

use(8)={n}

use(4,8)={i,v}

use(6)={n}def(6)={n}

use(5,6)={v,i,c}

def(1)={v, c}

use(1,3)={v}

use(4,5)={i,v}

use(5,7)={v,i,c}

use(7)={i}def(7)={i}

v and c are forwarded parameters Deriving test requirements

� List all du-pairs

� Based on du-pairs, derive du-paths

� Must be def-clear paths

� All Defs Coverage (ADC)� For each def, at least one

use must be reached

� All Uses Coverage (AUC)� For each def, all uses

must be reached

� All DU-Paths Coverage (ADUPC)� For each def-use pair, all

paths between defs and uses must be covered

Fall 2019 – University of Virginia 8© Praphamontripong

DU-Pairs à DU-Paths

Variable v

Variable c

Variable n

Variable i

Variable v

Variable c

Variable n

Variable i

defs afteruses, these are valid DU pairs

Fall 2019 – University of Virginia 9© Praphamontripong

ADC: DU-Paths à Test Paths

Variable v

Variable c

Variable n

Variable i

Test paths that satisfy All Defs Coverage

Fall 2019 – University of Virginia 10© Praphamontripong

AUC: DU-Paths à Test Paths

Variable v

Variable c

Variable n

Variable i

Test paths that satisfy All Uses Coverage

Variable v

Variable c

Variable n

Variable i

Fall 2019 – University of Virginia 11© Praphamontripong

ADUPC: DU-Paths à Test Paths

Variable v

Variable c

Variable n

Variable i

Test paths that satisfy All DU-Paths Coverage

Variable v

Variable c

Variable n

Variable i

Fall 2019 – University of Virginia 12© Praphamontripong

Summary� A common application of graph coverage criteria is to

program source – control flow graph (CFG)

� Applying graph coverage criteria to control flow graphs is relatively straightforward

� A few decisions must be made to translate control structures into the graph

� We use basic blocks when assigning program statements to nodes while some tools assign each statement to a unique node.

� Coverage is the same, although the bookkeeping will differ